search

intel / ehsm

An End-to-End Distributed and Scalable Cloud KMS (Key Management System) built on top of Intel SGX enclave-based HSM (Hardware Security Module), aka eHSM.
https://community.intel.com/t5/Blogs/Tech-Innovation/open-intel/An-Intel-SGX-based-Hardware-Security-Module-backed-Key/post/1360130?wapkw=eHSM
BSD 3-Clause "New" or "Revised" License
165 stars 51 forks source link

Support SM9 (cryptography standard) #263

Open nntp4 opened 1 year ago

nntp4 commented 1 year ago

Background

SM9 is a Chinese national cryptography standard for Identity Based Cryptography issued by the Chinese State Cryptographic Authority in March 2016(from wikipedia). it is also standardized in ISO 18033-5 .

Use cases

  1. communication between distributed IoT Devices, such as V2x (ie. vehicle to vehicle )
  2. communication between IoT Devices and Cloud Services, such as EV Charging Points and Cloud Services
  3. ...
yang8621 commented 1 year ago

Does openssl support SM9?

nntp4 commented 1 year ago

Does openssl support SM9?

it doesn't. But SM9 is implemented in GmSSL https://github.com/guanzhi/GmSSL. Should we use GmSSL in eHSM? @yang8621

yang8621 commented 1 year ago

eHSM depends on a customized openssl: https://github.com/intel/intel-sgx-ssl/tree/support_tls. It's forked from openssl but provides two functions:

  1. SGX customization, aka syscall handling. 2. SGX-based attested TLS.

eHSM is not a libOS-based solution, so that Gmssl cannot be used directly. SM9 has values in various use cases, as you mentioned. I will also do some homework on it. But currently, there are gaps to support it.

nntp4 commented 1 year ago

Thanks for your reply. If I want to do this work, could you give me some advice? I'm a newbie for Intel SGX.

yang8621 commented 1 year ago

With pleasure. The 1st thing is to build gmssl into sgx enclave. You can refer to https://github.com/intel/linux-sgx/blob/master/SampleCode/SampleEnclave/Makefile, especially focus on the Enclave settings. Standard std files cannot be used, instead, only SGX supported headers can be used. SGX removes all syscall support inside enclave, so that you may encounter many compiling errors like get time, IO, or even printf() etc. You can either disable the unused functions, or rewrite the function by SGX SDK: send sgx ocall to the ROS.